From patchwork Mon Nov 2 14:15:32 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gert Doering X-Patchwork-Id: 5551 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:6022:3119:b0:118:2077:975e with SMTP id e25csp5467023laa; Mon, 2 Nov 2026 06:15:52 -0800 (PST) X-Forwarded-Encrypted: i=2; AKwUvBx7gRK8nAsyjLUqN6+tJxKHcV8Byo2cb7TVQDeAdrNOq1wSxGX1v2WcKnrL/8NWv9C23fKxtLSh59E=@openvpn.net X-Received: by 2002:a05:7022:628a:b0:14d:c7ae:85dd with SMTP id a92af1059eb24-1ac5bbb917cmr19820913c88.7.1793628952049; Mon, 02 Nov 2026 06:15:52 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1793628952; cv=none; d=google.com; s=arc-20260327; b=oLilSsydVOcsM8EYgbaHaKgj6h+LSWGJCvD3WA+vg44gnRX2eBep+E+Q1K753is4az 2q8Ve4ksrXTtw9tWmZ7vVc8iesZXaVVGWg4nABC8r7vrbtNasak3WBOdIZC3K9k6woLt WmquR4GZr/0ePh/6jS0G2aIrHXZgLgNBCHSMxPegtmdLHGI9d1kS/PKWxlnPjoYSqc6B rAZH7kAqdGmJgiCUZtVI8GfEf5D7YT+Tc3YVCoIt1k3FZ6tPaLK0BuqXcqrpTqmgj/t0 wCxk41F+OY559uQ3KAScChGuTSeIsICqZzwFgoD5brAD+eIcu3kMEP2CmfnBsuw/1SP/ uOwg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature; bh=sy8/OSm9JgdoV+5mSpo4O0a43EhbxuLyrCfYm313spo=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=NRVfQ7oI89EHD2VWZ4i8ipzIyU8U7PfMPHBnxLcMbl26ytYYI+WkgtJ+nAMBzEB+i5 wDZF/nanj+AzDWyAG4XmsCNS8WkaPldBkEjDG875G8JcmvhONH52VqX9xLmSK64Ri1YO a2r+F61xJTihvbZ4NRiG92+gq9ouUOnBZxKOPOfRKjx9uuZ9ME/LYqCqMvJ8q1Bn85YW O7Kbwl5SVjVT9kBW41EEOlULn6wveEZYdyVduja053AqmkcU7AHl5iQVc2soZqLWC0VN wmP8sM71EjUg11wTDX2sCHFyFNXqaQyfJMBBIM3gcSJc33SDr0l1mlo5G3vmmaRHemM1 XXeA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=SFaMp67e; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=CkqtVtxP; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=cap0rL7E; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id a92af1059eb24-1ac1a50c7bdsi30385471c88.61.2026.11.02.06.15.50 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 02 Nov 2026 06:15:52 -0800 (PST) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=SFaMp67e; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=CkqtVtxP; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=cap0rL7E; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Unsubscribe-Post: List-Owner; bh=sy8/OSm9JgdoV+5mSpo4O0a43EhbxuLyrCfYm313spo=; b=SFaMp67eN1p/SQ iwUey//wny46VWQHBKde89cvkDproAymLwQmAigktPM7+nu34B1lmdj1TT/dXhQrcTguzJnIKnWWT I1VrDy0xqvrlQ4rlTU1h7cVJv4Ph4sucurQid4Z4vpFF7XtN6nJHutfBM1ibTRDqDQYrw73LcLdkE /XE=; Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.100.1) (envelope-from ) id 1xNspA-000000005Au-1jA7; Mon, 02 Nov 2026 14:15:48 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.100.1) (envelope-from ) id 1xNsp9-000000005An-08cu for openvpn-devel@lists.sourceforge.net; Mon, 02 Nov 2026 14:15:47 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Unsubscribe-Post:List-Subscribe:List-Post:List-Owner:List-Archive; bh=IACQU0SkMMVjXgRu0QGvMBquPTOkDnuGjMrJ2O0z7gc=; b=CkqtVtxPkt1IBqCkIgKgEZC/Mm 4w72YFOaMzs3TQ3AVz5pjt8AvoASLf6bmwodNcLH9jL3yl7H7wVSb84Eo5TuZRgQVp/n7qwPuLjXH D6qgRd4Y6zcJ61oL9dMm0bVQ6J6b3CrDpy0RMkGpsGFV/DN5zOvDEgF0+9HPSBWzjbR0=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Unsubscribe-Post: List-Subscribe:List-Post:List-Owner:List-Archive; bh=IACQU0SkMMVjXgRu0QGvMBquPTOkDnuGjMrJ2O0z7gc=; b=cap0rL7Eh9i861CDZJDuABa6WT CjEf4uFhkCh8Sd8Mk5pm8TPG3eY+NtyxBqiB7Y6az8RFhFZi7hbhc6+D+y71MKLGiSj//4FLxr4Oc z20RE2DgrlXokgyqIUJOMM2N2s8/zhZWWsn2mHmAC+MTZApyw9fqar5cjsxmKC3JFkn4=; Received: from [193.149.48.129] (helo=blue.greenie.muc.de) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.100.1) id 1xNsp7-000000001BY-0sOk for openvpn-devel@lists.sourceforge.net; Mon, 02 Nov 2026 14:15:46 +0000 Received: from blue.greenie.muc.de (localhost [127.0.0.1]) by blue.greenie.muc.de (8.18.1/8.18.1) with ESMTP id 6A2EFc4Q029883 for ; Mon, 2 Nov 2026 15:15:38 +0100 Received: (from gert@localhost) by blue.greenie.muc.de (8.18.2/8.18.1/Submit) id 6A2EFc0p029882 for openvpn-devel@lists.sourceforge.net; Mon, 2 Nov 2026 15:15:38 +0100 From: Gert Doering To: openvpn-devel@lists.sourceforge.net Date: Mon, 2 Nov 2026 15:15:32 +0100 Message-ID: <20261102141538.29830-1-gert@greenie.muc.de> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: 1.3 (+) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Razvan Cojocaru generate_key_expansion_openvpn_prf() returned early without wiping master when either openvpn_PRF() call failed. Wipe it at a single exit point. Change-Id: Icf823c286e48726934131af722fadee4a2ef7a56 Signed-off-by: Razvan Cojocaru Acked-by: Steffan Karger Gerrit URL: https://gerrit.openvpn.net/c/openvpn/ [...] Content analysis details: (1.3 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URI: openvpn.net] 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS X-Headers-End: 1xNsp7-000000001BY-0sOk Subject: [Openvpn-devel] [PATCH v1] ssl: wipe PRF master secret on failure paths X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1880756271805655270 X-GMAIL-MSGID: 1880756271805655270 From: Razvan Cojocaru generate_key_expansion_openvpn_prf() returned early without wiping master when either openvpn_PRF() call failed. Wipe it at a single exit point. Change-Id: Icf823c286e48726934131af722fadee4a2ef7a56 Signed-off-by: Razvan Cojocaru Acked-by: Steffan Karger Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2088 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2088 This mail reflects revision 1 of this Change. Acked-by according to Gerrit (reflected above): Steffan Karger diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c index 086a6fc..03180c6 100644 --- a/src/openvpn/ssl.c +++ b/src/openvpn/ssl.c @@ -1503,6 +1503,7 @@ generate_key_expansion_openvpn_prf(const struct tls_session *session, struct key2 *key2) { uint8_t master[48] = { 0 }; + bool ret = false; const struct key_state *ks = &session->key[KS_PRIMARY]; const struct key_source2 *key_src = ks->key_src; @@ -1521,7 +1522,7 @@ sizeof(key_src->client.random1), key_src->server.random1, sizeof(key_src->server.random1), NULL, NULL, master, sizeof(master))) { - return false; + goto exit; } /* compute key expansion */ @@ -1530,13 +1531,15 @@ key_src->server.random2, sizeof(key_src->server.random2), client_sid, server_sid, (uint8_t *)key2->keys, sizeof(key2->keys))) { - return false; + goto exit; } - secure_memzero(&master, sizeof(master)); key2->n = 2; + ret = true; - return true; +exit: + secure_memzero(&master, sizeof(master)); + return ret; } /*